What’s Vulnerable › Vulnerabilities

CVE-2022-47523

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 70.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-01-05 · updated 2026-06-17
• Weakness: CWE-89

Description

Zoho ManageEngine Access Manager Plus before 4309, Password Manager Pro before 12210, and PAM360 before 5801 are vulnerable to SQL Injection.

Affected products

• Zohocorp ManageEngine Access Manager Plus: before 4.3; 4.3-build4300, 4.3-build4301, 4.3-build4302, 4.3-build4303, 4.3-build4304, 4.3-build4305 (+3) — fixed in 4.3
• Zohocorp ManageEngine PAM360: before 5.8; 5.8-build5800 — fixed in 5.8
• Zohocorp ManageEngine Password Manager Pro: before 12.2; 12.2-build12200 — fixed in 12.2

How to fix

Upgrade to a fixed version: Zohocorp ManageEngine Access Manager Plus 4.3; Zohocorp ManageEngine PAM360 5.8; Zohocorp ManageEngine Password Manager Pro 12.2. Check the vendor advisory for mitigations.

References

• https://www.manageengine.com/privileged-session-management/advisory/cve-2022-47523.html
• https://www.manageengine.com/privileged-session-management/advisory/cve-2022-47523.html

Get alerted when CVE-2022-47523 or the next vulnerability affects your stack